i was looking at the admin audit logs today and found it very usefull. But it doesn't include the source computer launching the commands.
An example, i have the EMC on my computer modifying some distribution list on exchange which is a different machine. In the logs it will say source as being the exchange server and not my computer.
Is there a way to change taht? or have more details?
Thanks
